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Abstract 

Reusable models of common elements for 
communication, computation, decision and control in 
air traffic management are necessary in order to 
enable simulation, analysis and assurance of 
emergent properties, such as safety and stability, for a 
given operational concept. Uncertainties due to 
faults, such as dropped messages, along with non- 
linearities and sensor noise are an integral part of 
these models, and impact emergent system behavior. 
Flight control algorithms designed using a linearized 
version of the flight mechanics will exhibit error due 
to model uncertainty, and may not be stable outside a 
neighborhood of the given point of linearization. 
Moreover, the communication mechanism by which 
the sensed state of an aircraft is fed back to a flight 
control system (such as an ADS-B message) impacts 
the overall system behavior; both due to sensor noise 
as well as dropped messages (vacant samples). 
Additionally simulation of the flight controller 
system can exhibit further numerical instability, due 
to selection of the integration scheme and 
approximations made in the flight dynamics. 

We examine the theoretical and numerical 
stability of a speed controller under the Euler and 
Runge-Kutta schemes of integration, for the 
‘Maintain’ phase for a “Mid-Term (2035-2045) 
Interval Management (IM) Operational Concept” for 
descent and landing operations. We model 

uncertainties in communication due to missed ADS- 
B messages by vacant samples in the integration 
schemes, and compare the emergent behavior of the 
system, in terms of stability, via the boundedness of 
the final system state. Any bound on the errors 
incurred by these uncertainties will play an essential 
part in a composable assurance argument required for 
real-time, flight-deck guidance and control systems,. 
Thus, we believe that the creation of reusable models, 
which possess property guarantees, such as safety 
and stability, is an innovative and essential 
requirement to assessing the emergent properties of 
novel airspace concepts of operation. 


Introduction 

Currently, traffic controllers retain overall 
separation responsibility in National Airspace System 
(NAS), and will continue to do so in the FAA- 
defined IM operational concept. In the longer term, 
Next Generation Air Traffic Operational Concepts 
may potentially encounter a shifting locus of control 
from today’s centralized model, adding novel 
communication and control concerns. While these 
concepts will likely not be realized in the near future, 
we wish to build publically available, reusable 
models of common computation, decision and control 
elements that will encompass the behavior exhibited 
by these elements in near-term (2015-2025) ConOps, 
along with enabling the functionality to be exhibited 
by these components in the as-of-yet unrealized 
future systems. 

We wish to consider a ‘Mid-Term’ (2035-2045) 
concept of operations for the ‘Maintain’ portion of 
IM, when aircraft will have both ADS-B -in and 
ADS-B-out to support trajectory management [1,2]) 
and situation awareness. FAA, MITRE and NASA 
Aeronautics research has been primarily focused on 
the ‘achieve’ phase of the current IM concept, as that 
is believed to be the phase where the greatest benefit 
is to be accrued, as is the only phase where trajectory 
based operations is regarded as being necessary. For 
the ‘Mid-Term’, ADS-B enabled operational concept, 
the fault assumption that ADS-B/GPS messages can 
be omissive (or even incorrect), thus requiring the IM 
velocity control algorithm to use stale or estimated 
data, becomes an important consideration even in the 
‘Maintain’ phase. In the simplest approach, we wish 
to maintain fixed time spacing between the IM and 
target aircraft (referred to as ‘station keeping’). This 
form of velocity controller can be modified to assist 
in any ‘required time of arrival’ (RTA) approach 
currently employed to sequence aircraft arriving at 
the terminal area. 

It is impossible to eliminate uncertainties in 
physically-realized control systems. Uncertainty can 
be classified into two categories for these systems: 



disturbance signals and dynamic perturbations. The 
former includes input and output disturbance (such as 
a gust on an aircraft), sensor noise (such as corrupt or 
missing messages) and actuator noise. The latter 
represents the discrepancy between the mathematical 
model and the actual dynamics of the system in 
operation. A mathematical model of any real system 
is always just an approximation of the true, physical 
reality of the system dynamics. Typical sources of the 
discrepancy include unmodeled (usually high- 
frequency) dynamics, neglected nonlinearities in the 
modeling, effects of deliberate reduced-order models, 
and system-parameter variations due to 
environmental changes and torn-and-worn factors. 
These modeling errors adversely affect the stability 
and performance of a flight control system. 

Ultimately, our reusable models must be 
executable and analyzable, in order to enable 
simulation and facilitate the creation of assurance 
arguments for overall systems properties. These 
models should carry guarantees of their behavior, 
such as safety or stability proofs, which do not have 
to be re-derived in an overall system context, as long 
as all assumptions and fault hypotheses are met. For 
example, any operational concept enabled by ADS-B 
is enhanced by considering the notion of dropped or 
incorrect messages, as the correctness of any 
algorithms implemented relying upon the 
measurements contained in ADS-B messages (and 
the constant 1 Hz broadcast rate) can greatly impact 
emergent properties.. 

In this paper, we derive a theoretically and 
numerically stable 1M velocity controller that is 
robust to the uncertainties presented due to model 
nonlinearities, integration scheme inaccuracies, and 
communication (sensor feedback) errors. In the next 
section, we provide a description of the Interval 
Management concept, and focus on stability concerns 
in the ‘Maintain’ phase. The third section is used to 
examine and bound uncertainties due to non- 
linearities arising in differing modeling formalisms. 
In the fourth section, we compare the numerical 
stability of various integration schemes used in the 
simulation of the aircraft trajectories. We then derive 
a robust velocity controller that is theoretically and 
numerically stable by design. The subsequent 
section discusses a low fidelity simulation 
environment used to simulate the aircraft, as well as 
outline the flight profiles flown. We then compare 


and contrast the fidelity of the simulations and the 
efficacy of the theoretically and numerically stable 
controller under both nominal operating conditions, 
as well as dropped communications. Finally, 
conclusions are drawn, and avenues for further 
inquiry are proposed. 

Near-Term Interval Management 
Concept s 

An important construct in enabling new air 
traffic operations is ensuring that the system provides 
the agents with the flexibility necessary to robustly 
respond to disruptions and disturbances, while 
increasing overall system capacity[3]. As clearly 
defined in [4], the 1M concept involves an air traffic 
controller issuing an 1M clearance to a candidate 
aircraft. The onboard software of the 1M cleared 
aircraft then provides a precise speed for the aircraft 
to maintain. The pilot is responsible for 
implementing and maintaining the precise speed 
profile provided by the onboard software. The 
controller, however, maintains responsibility for 
assuring separation between aircraft. 

The main objective of the operational concept is 
for 1M aircraft to achieve and maintain an assigned 
spacing goal relative to a target aircraft. The 
provision of precise guidance within the flight deck 
enables the flight crew to actively manage the 
spacing relative to the target aircraft, without further 
overt controller action, thereby reducing controller 
workload. The fundamental enabling concept behind 
1M is the provision of velocity commands derived by 
a flight deck velocity control algorithm to maintain a 
localized relative spacing in the face of operational 
uncertainties and environmental effects, such as 
varying aircraft flight modes, performance 
characteristics and winds. 

The interval management concept of operations 
can be implemented during any phase of flight. In 
this paper, we examine the 1M concept applied to the 
terminal area, more specifically, in the context of the 
optimal profile descent (OPD) maneuver [5]. An 
optimal profile descent acts to minimize the fuel 
consumption of the aircraft during the descent phase 
of flight, in the terminal area. The 1M concept 
attempts to achieve the assigned spacing interval 
(defined as a time or distance) by a specified 
‘Achieve By Point’. Examples of such points are the 



meter fix to the terminal airspace, the runway 
threshold, or any other waypoint. 

Abbreviated Survey of Prior Research In 
Interval Management 

Interval Management in its various forms has 
been investigated by several organizations, such as 
MITRE [6-8], EuroControl [9-12], NASA [4, 13-14] 
and the FA A [15,16]. Evaluations performed by 
MITRE address both human-in-the-loop simulations 
as well as theoretical modeling approaches. A 
thorough definition of an interval management 
concept of operations is outlined by Levitt and Weitz 
[6,7]. 

Eurocontrol has worked on the ‘CoSpace’ 
concept, which studies terminal area procedures. 
Eurocontrol’s sequencing and spacing concept 
addresses controller workload, as opposed to aircraft 
efficiency. Furthermore, algorithm(s) used in the 
CoSpace Concept are time -history based, and not 
based on 4-D trajectories, thus limiting the study to 
traffic arriving from a single direction. The CoSpace 
Concept includes both a ground based as well as 
airborne component. The ground based components 
provide sequencing and spacing functions, 
whereupon the cleared aircraft achieve the desired 
spacing through adherence to the speed commands 
generated by the flight deck speed controller. Mohleji 
and Wang perform an analysis on position and 
velocity errors introduced by ADS-B in the context 
of Airborne Spacing-Flight deck Interval 
Management (ASPA-FIM) [8]. The authors 
formulate a Gauss-Markov model for the GPS 
position errors in order to perform Monte-Carlo 
simulation to validate that the number of speed 
commands generated is acceptable to the flight crew. 
The simulation model is complex, as it encompasses 
models for flight dynamics, winds and 
position/velocity errors, as well as rudimentary 
communication failures. The formulation possesses a 
mechanism for modeling dropped ADS-B messages, 
along with other common modes of failure in 
communications, which are prevalent with ADS-B 
technology in the current airspace. While addressing 
the time correlation between position measurement 
errors, the models used do not account for message 
collisions, which may occur in a densely populated 
airspace, such as a terminal area. 


Penhallegon et al. [17] perform a human-in-the- 
loop study of the IM concept during departure. 
Sixteen airline pilots participated in a variety of 
operational scenarios (seven nominal, two off- 
nominal) in the Hartsfield Jackson Atlanta 
International Aiiport (KATL) region, during 
departure from 10,000 ft to cruise altitudes, using 
either precise goals or open-with-capture (OWC) 
directives. The precise goals required that a specific 
value be used to achieve or maintain an altitude, 
while the OWC goals required that IM speeds be 
provided to achieve the assigned spacing goal at the 
achieve by point only if the IM aircraft was predicted 
to achieve a spacing interval less than the assigned 
spacing goal. Several key issues that were found 
during the study concerned the use of unrestricted 
climbs out of the terminal area. The ability to have 
accurate measurements at regular intervals (i.e. , 
ADS-B) directly influences the number of velocity 
changes that must be made in order to adhere to the 
climb profile. Thus, any verification of an IM speed 
controller must encompass models of dynamic 
(aircraft and otherwise) as well as environmental 
uncertainty, and should be robust enough to capture 
relevant coupling effects in both operational 
procedures as well as flight dynamics. The issue of 
dropped or incorrect time, position, or velocity 
measurements must be considered carefully in 
assessing the correctness (or robustness) of any 
designed velocity controller. 

A similar study was performed at NASA 
Langley [4], this time in reference to arrival 
operations, which considered the Interval 
Management concept with respect to spacing on 
parallel dependent runways. The scenario concerned 
the Dallas Fort-Worth Terminal Area (KDFW), 
where pilots attempted closely spaced parallel 
approaches under the Interval Management 
operational concept. Again, several standard 
assumptions were made during the experiment, 
including the lack of error in the ADS-B and CPDLC 
messages. Subsequent interval management research 
efforts maintain this assumption regarding 
communication models [31]. 

Stability of the Velocity Controller in 
‘Maintain ’ Phase of IM 

Velocity control algorithms for the IM concept 
of operations have been studied in depth. Abbot [28] 
has proposed a PD controller which does not require 



any special ADS-B message format, compensates for 
dissimilar final approach speeds between aircraft 
pairs, and provides guidance for a stable final 
approach. This algorithm has been extensively tested 
in Monte Carlo simulation and has been evaluated in 
piloted simulation. Weitz and Hurtado [29] specify 
both a PD controller and a sliding mode controller 
(switched PD controller). Tracking an arbitrary path 
can lead to string instabilities, or the growth of 
spacing errors along the formation, which 
necessitated the application of a string-stable control 
law. A sliding-mode controller was then 

implemented, which uses information for the 
reference trajectory and the ideal trajectory to achieve 
the desired formation. This controller is not a time- 
based spacing controller, and is dependent on a 
reference trajectory as well as the relative distance to 
the target aircraft. 

Ivanescu [10] uses a nonlinear dynamical model 
for the aircraft, but provides a “spacing director” 
which is a quantized (Discrete) PD 
controller. Similarly, Lambregts [27] uses Energy 
Methods (Hamiltonian) as a dynamic formulation for 
the equations of motion, but does not consider 
computational stability (the controller derived cannot 
be stably integrated under explicit integration 
methods for large step size or large gains or large 
disturbances). 

We wish to investigate whether, in the presence 
of dropped messages, an aircraft that can fly a 
trajectory based approach to a required degree of 
precision, and thus possibly continue the 1M function 
in the ‘maintain’ phase of the concept. Maintaining 
a fixed interval is called station-keeping, and is 
fundamentally different than the ‘achieve’ part of 1M. 

Crucial to this speed control concept is the 
feedback control mechanism by which the onboard 
speed controller compares the measured position and 
velocity of the 1M aircraft to the desired 4-D 
trajectory values. Any velocity control algorithm 
will be extremely sensitive to failures in 
measurement technology, be it dropped or incorrect 
ADS-B messages, or even Inertial Measurement Unit 
(IMU) inaccuracies that directly impact the Inertial 
Navigation System (INS). Current efforts [28,29] 
utilize varying forms of proportional derivative 
control, which are unstable under high gains. The 
sliding mode controller proposed in [29] is not easily 


amenable to standard Lyapunov stability analysis; 
assuring its stability may prove to be intractable. 

We use the technique of feedback linearization, 
in order to design a theoretically stable robust 
velocity controller model that employs the pitch 
angle as the control input. This allows us to derive 
an outer-loop PID controller which is guaranteed to 
be stable as long as there are no right half plane 
poles, and no non-minimum phase zeros. We can 
then bound the error incurred during numerical 
simulation, due to the dynamic model and integration 
scheme employed. Furthermore, the resilience of the 
controller to a limited number of faulty messages 
(i.e., dropped messages) can be determined, by 
bounding the state error of the aircraft’s trajectory at 
the final waypoint. We recognize that current flight 
operations are adequately ensured by today’s flight 
control systems. However, we anticipate that ‘Mid- 
Term’ operational concepts enabled by the use of 
ADS-B In and Out, will place additional 

requirements in terms of emergent behaviors of these 
controllers, in regard to overall system stability and 
safety. We believe that provably demonstrating the 
stability of such controllers in a compositional 
fashion will be one of the necessary steps to ensure 
safe emergent behavior of multiple aircraft 
participating concurrently in ‘Mid-Term’ IM 
operations. 

The baseline profile used in the following 
simulation work in this paper details the aircraft’s 
descending profile in the terminal area is as follows, 
and is based on [14]. The aircraft transitions from its 
cruising altitude at the Top of Descent (TOD) to an 
idle -thrust constant Mach descent profile. At the 
requisite altitude it captures the constant thrust 
calibrated airspeed (CAS) descent profile as specified 
in [14], until the aircraft is approximately at 12,000- 
10,000 ft MSL, and where it then undergoes a 
powered deceleration maneuver (some combination 
of drag devices and throttle movement) in order to 
shallow out the flight path angle while meeting the 
required time of arrival at the desired waypoint for 
final approach [14], 

We will now derive a model for a theoretically 
and numerically stable velocity controller that is 
robust to the uncertainties presented due to model 
nonlinearities, integration scheme inaccuracies, and 
sensor/actuator (communications feedback) errors. 
With the possibility of stale or inaccurate 



measurements being used by the velocity controller, 
the trajectory modeling techniques employed must be 
resilient to uncertainties and disturbances present in 
the environment. The correctness of the velocity 
control algorithm will be sensitive to the modeling 
dynamics used to denote the aircraft (plant), the 
integration scheme used to propagate time and 
measurements forward, and the controller dynamics 
(i.e., number of differentiator and/or integrators 
used). 

Stability Issues and Non-linearity in 
Aircraft Trajectory Models 

Trajectory modeling is a rich field [6, 8, 29, 30]. 
Using the informal notion of “best equipped, best 
served”, aircraft which can achieve a higher 
conformance to the “required performance” of 
trajectory prediction, negotiation, and guidance in a 
4-D trajectory-based operations environment, may be 
able to execute procedures such as 1M. We briefly 
enumerate several simple models, kinematic and 
dynamic, of the aircraft trajectory, provide all the 
constants necessary for the replication of the 
simulations, and discuss the impact of uncertainty 
due to non-linearity on the stability of the system. 
Additionally, the utility of the Hamiltonian 
representation over the Newtonian, and its effect on 
the numerical stability and precision of potential 
integration schemes is explained, especially in 
relation to higher fidelity models. 

For the dynamic models, we are able to 
mitigate the error incurred due to non-linearity. We 
then simulate the descent phase of flight to examine 
theoretical and numerical stability of a controller 
designed through linearized feedback techniques. 

Bounding Non-Linearities: Kinematic Model 

The current version of the modular environment 
used in this research for simulation purposes, 
employs a kinematic model to project the aircraft 
trajectory between the flight plan’s waypoints. A 
simple averaging function is used to project the 
aircraft trajectory forward between waypoints as 
follows: 


velocity for values between waypoints [t;,t i+1 ) are then 
found using the corresponding kinematic equations: 

v(t) = v(ti) + a(t) * (f - t f ) 

_ _ 1 

d{f) = d(t t ) + -a(t)(t - tj) 2 

Note that this is a piecewise linear function for the 
velocity. Any bound on the error due to non-linearity 
in the flight dynamics is directly dependent on the 
point of linearization (i.e., mode of flight and system 
state around which it is linearized). The effect of 
external forces and moments is not accounted for in 
this representation. 


Bounding Non-Linearities: Dynamic Model 

Here, we summarize the body fixed coordinate 
equations of motion, found in [18], and define all the 
necessary constants employed in the model, in order 
to reproduce the simulation results (whose values are 
given in Tables 1 and 2). We have the following 
equation of motion: 

dW 

T — D — mg sin(y) H — — = mV t 
dt 


where V t is the true airspeed, T is the thrust, D is the 
drag, m is the aircraft mass, g is gravitational 
acceleration, and W is the wind parallel to the path 
[18]. We approximate the drag as: 


D = ^ pV t z A s C D 


D - 2? Vt As 1 Cd -° + 


neAR I 


where p is the air density, A s is the gross wing area, 
and C D is the non-dimensionalized drag co-efficient. 
C D is then further expanded, where e is the wing span 
efficiency (approximately 0.85-0.95), AR is the 
aspect ratio (ratio of the square of the wingspan to its 
planform area) and C D0 is the drag at zero lift 
conditions. Recall that at zero power conditions, 
C Di0 * \c Di [19]. 

This allows us to express the governing nonlinear 
differential equation of motion as: 


a(t) = 


v(t i+1 ) - v(fi) 


, t G [tj, t;+i) 


l i+ 1 


where the velocities and positions are specified at the 
successive i th and (i+l) th waypoints. The distance and 


V t = 


1/2 pV t 2 K D 
m 


g sin(y(x)) 


under zero wind conditions. 



Employing feedback linearization using the input 
variable y allows us to strictly bound the error due 
to non-linearities in the system dynamics. If there is 
no model uncertainty in the non-linear dynamics, and 
the relative degree of the output is the same as the 
degree of the state equation (with respect to the 
input), then the approximation is exact. However, the 
measured state providing feedback to the system, 
given by the ADS-B message detailing its position, 
means that the Newtonian dynamics result in a 
second order non-linear differential equation, which 
poses problems both for controller design and 
integration scheme stability. 

Use of the Hamiltonian formulation is 
preferable, instead of arriving at a second order 
equation of motion in an n-dimensional coordinate 
space, the use of Hamilton’s Equation yields a set of 
first order differential equations on a 2n-dimensional 
coordinate space. This is exceedingly useful, as most 
classical integration methods, such as the Runge- 
Kutta and Euler methods, require the system to be 
expressed as a set of first order differential equations 
[ 21 ]. 

By choosing the principle coordinate q to be 
along the path direction, the momentum along this 
path is expressed as p = mV t . Assuming the aircraft 
mass remains constant, we obtain the pair of first 
order differential equations: 

Kp 2 

p = —mg sin y — — — 

2m 

dq p 
dt m 

where k = 4pA s C 2 /3mneAR. Thus we have two 
first order differential equations, which can be used 
under feedback linearization techniques to design a 
theoretically stable controller for the non-linear 
system. This alternate derivation to Newtonian 
dynamics, which produces first order differential 
equations, can be used directly in the two main 
integration schemes such that stable (fully reversible) 
implicit integration can be performed. 

Integration Schemes 

For the simulation of the 4-D trajectories, we 
consider the two most common schemes: the Euler 
Method of integration and the Runga-Kutta 


integration scheme. Further details of these 
approaches can be found in [20], 

The stability of an integration method refers to a 
methods’ performance against the solution to the test 
system x = Ax, (A — AI) = 0, where A is a complex 
number (an eigenvalue of the square matrix A, 1 is 
the identity matrix) whose real part is negative. The 
solution to this system for values complex values of A 
whose real part is nearly zero, is dependent on 
integration step size and truncation/rounding error. A 
method is zero stable if all of the eigenvalues are in 
the left half plane. We wish to ensure that the speed 
controller designed is both theoretically and 
numerically stable with respect to the assumptions 
required in the derivation of the corresponding 
equations of motion used. 

The step size used in Euler integration is limited by 
stability. In general, explicit time marching 
integration methods are not suitable systems where 
computation with large steps may be necessary when 
the solution changes slowly (i.e., when the accuracy 
does not require small steps). Instead we utilize the 
backward (implicit) Euler method in our 
implementation [20], in conjunction with the 
Hamiltonian formulation. 

Euler’s implicit method yields fairly accurate results 
for reasonably small step sizes At. The local 
truncation error is bounded by: 

1 

frOn) = 2 *0n)At + 0(At 3 ) 

and global truncation error bounded by: 

AtM . 

£i(0 = ^r( e ( )_1 ) 

where M is the upper bound on x for the given 
interval (t-t 0 ) and F is Lipschitz, continuous in its 
second argument, with Lipschitz constant L. Thus, 
we achieve a global error bound proportional only 
to the maximum rate of deceleration in the fixed 
time horizon (t-t 0 ), which is the length of the 
simulation. Thus, for a fixed maximum deceleration, 
the global truncation error is bounded from above by 
a constant, fixed by the maximum deceleration rate. 

For most problems, the fourth-order Runge- 
Kutta method gives the highest accuracy-effort ratio 
[20]. We simultaneously iterate the pair of 
differential equations derived from the Hamiltonian, 
by using the fourth-order Runge-Kutta algorithm 



outlined in [20]. Thus, the local truncation error (the 
error induced for each successive stage of the iterated 
algorithm) will behave like s L = C At 5 , where C is a 
number independent of At, but dependent on t 0 and 
the fourth derivative of the exact solution at t 0 (the 
constant factor in the error term corresponding to 
truncating the Taylor series for q(t 0 + h) about t 0 at 
which has order At 4 ). Unfortunately, explicit Runge- 
Kutta methods, especially when used in the solution 
of partial differential equations, are not globally 
stable (non-reversible). Implicit fourth order Runge- 
Kutta methods are computationally expensive, and 
are not often suitable for real time applications. Thus, 
we wish to benchmark the accuracy of the 
numerically stable implicit Euler method, with that of 
the locally stable (but more accurate) Runge-Kutta 
method. 

Velocity Controller 

We wish to consider the global asymptotic 
stability of a controller along with its corresponding 
numerical stability, with respect to disturbances (i.e., 
dropped messages) in tandem. It is non-trivial to 
prove the stability of a nonlinear system under PD 
control; we wish to employ feedback linearization in 
order to assure both numeric and theoretical 
stability by design. 

As a quick aside, we mention that there are 
several types of velocity associated with aircraft in 
flight. The true airspeed (TAS) of the aircraft is the 
speed of the aircraft relative to the atmosphere. In 
the absence of wind, the true airspeed is equal to the 
groundspeed. The calibrated airspeed (CAS) is the 
indicated airspeed of the aircraft corrected for 
instrumentation error, at standard temperature and 
pressure. The CAS and TAS are related through an 
implicit function that must be iteratively solved. The 
Mach number of the aircraft, usually defined while 
the aircraft is at high speeds and altitude, is given by 
the ratio of the true speed of the aircraft to the speed 
of sound at that altitude. We will deal predominantly 
with the TAS and the CAS in the remaining sections 
of this paper. 

Recall that the dynamics for the aircraft in 
descent conditions is represented by a non-linear 
differential equation. We wish to design a controller 
that uses the flight path angle as the control variable, 
in order to enable feedback linearization, thereby 
facilitating the construction of a stable -by-design 


controller for the non-linear system. We note that it 
is equally valid to employ the throttle (or thrust) as 
the control variable, but do not consider this avenue. 

The pilot controls the flight path angle by adjusting 
the pitch angle (a), through deflection of the elevator 
(8 e ). We acknowledge that this will change the 
vertical path, possibly adding difficulty in making the 
final altitude constraint. 

Feedback Linearization 

The central idea in feedback linearization is to 
algebraically transform nonlinear systems dynamics 
into (fully or partly) linear ones, so that linear control 
techniques can be applied [32]. This differs entirely 
from conventional (Jacobian) linearization, because 
feedback linearization is achieved by exact state 
transformation and feedback, rather than by linear 
approximations of the dynamics. The basic idea of 
simplifying the form of a system by choosing a 
different state representation is not completely 
unfamiliar; rather it is similar to the choice of 
reference frames or coordinate systems in mechanics. 
The Hamiltonian formulation, with its symmetry in 
state variables, lends itself particularly to this 
approach. 

If we regard the position of the aircraft (given by 
an ADS-B message) as the measured output of the 
system y = q, feedback linearization requires that we 
differentiate the output until the physical input y 
appears in the r th derivative of y. Thus, in our case, 
r=2. Then y is chosen to yield a transfer 
function from the "synthetic input", v(t), to the 
output y which is given by: 

Y(s) _ 1 _ 1 
U(s) s r s 2 

whereby if r is the same as the order of the 
system, as in our case, input/output feedback 
linearization is equivalent to input/state 
linearization, and we do not have to worry 
about internal dynamics. 

In state space formulation, we have: 
x = f{x) + g(x ) siny 
y = h(x ) 

where: 



X = 



/(*) = 


pA s q 2 f 4 C\ V 
2 m 2 \3neAR J 
V 


m 


g{x) = q 



X 


Here, y and y are scalars. Using the standard 
notation from operator theory [32], we have: 

dh . 

y = — xh^(h) + L g {h) siny = L}(h) 

but: 


Lgih) = 0 


Thus, in our case we have a double integrator linear 
system. We can now design a stable controller for 
this system using any linear controller design 
method. We chose, for robustness: 


k = o 


v(x) = — ^ c k l!f(h) 

(ywp — y ) 

i r T 

- {y wv - y)di 

T -to 


+ K C \ 

1 

+ 


Here the first term in the expression is the 
standard feedback linearization term (with Ck 
being the coefficients of the second order 
differential equation expanded around the 
waypoint y wp ), and the second term is tuned 
online for robustness, as is performed in the 
next subsection. That controller is then 
implemented and obtained through: 


siny = 


1 


[— er(x) + v(x)] 


so: 

y = L}(h) 

thus we must take: 

9 = L}(h) + L g (h}(h)) siny 

Now, set: 

er(x) = L 2 f(h) 
q{x) = L g 

then: 

v(x) = er(x) + q(s) siny 

where v(x) is the synthetic input (or synthetic 
control). 



r integrators 

Figure 1: Synthetic Input For Feedback 
Linearization 


where the only error encountered will result from the 
Taylor series approximation of sin(y), which can be 
made precise to within the desired floating point 
precision. Thus, the controller is stable by 
construction. 

Outer Loop Control: Proportional Derivative 
Integral (PID) Control 

Proportional-Integral-Derivative control is the most 
common form of control applied in industry today 
[19,21], A PID controller takes the form: 

f 1 deft) 

u(t) = K p e(t) + J Kie(t)dt + K d 

where e(t) is the error, and the gains must be tuned 
concurrently. The proportional component combats 
present error. By raising the proportional gain K p we 
attain a faster response to changes in plant dynamics 
and a lower e(t); however, increasing the gain too 
much leads to overshoot and instability. The 
derivative component K d combats future error, by 
counteracting the overshoot. The integral component 
combats past (cumulative) error, and eliminates the 
steady state error by modulating the plant input so 
that the time-averaged error is zero. 







For our system, we use the classical Ziegler - 
Nichols Tuning Method, and take K p = l/2K C , 
Ki = 2K p /T c , and K D = T c K p / 8, where K c is the 
critical gain at which the plant under pure 
proportional control begins to oscillate, and T c is the 
oscillation period at that gain. For our given 
dynamics, we take K P = 2.5, T c = 4. This allows us 
to maintain the desired flight path angle throughout 
the descent to ensure a constant Mach and constant 
CAS under idle -thrust. For the outlined PID 

controller and the Runga-Kutta integration scheme 
with step-size of 1 second and 60 seconds, the system 
is stable, as the integration scheme is zero stable. 

Linear Quadratic Gaussian (LQG) Control 

An LQG controller is the combination of an 
optimal estimator (Kalman Filter) and an optimal 
regulator (linear quadratic), which, in special cases, 
can be designed independently using the separation 
principle [22], The LQG controller is a unique 
controller and constitutes a linear dynamic feedback 
law that is computable in real time. It is also the 
fundamental solution to the optimal perturbation 
control problem of a corresponding non-linear 
system. 

While our PID velocity controller is sufficiently 
robust to maintain our desired Interval Tolerance 
throughout the constant thrust portion of the descent, 
we have neglected in this preliminary study, the 
vector field which describes the wind’s impact on the 
flight path (both in the along path and cross-track 
directions). If the wind is accurately modeled as an 
additive Gaussian white noise distribution, and we 
model the non-linear portion of the dynamics as a 
linear system with bounded uncertainties, and 


formulate the control variable as being subject to 
quadratic cost (i.e., limit the maximum energy of the 
control signal), we would then choose to implement a 
LQG controller 

Simulation Results 

We will now consider two aircraft flying 
Optimal Profile Descents (see Figure 2). The IM 
aircraft is assigned a target aircraft to follow from the 
Top of Descent (TOD) point. The aircraft assigned 
the same waypoint fixes (which is not a requirement 
for IM, but made processing easier), and are spaced 
by an Interval Tolerance (IT) x, which is the time 
based equivalent of a fixed distance separation. The 
aircraft transition from a constant cruise, at a velocity 
approximately of 340 knots (0.87M) at FL390 to a 
constant Mach descent. At approximately FL250, the 
aircraft then captures a constant CAS descent, to 
finish at approximately 12,000 ft MSL with a speed 
of 250 knots. The aircraft then performs a (possibly 
powered) maneuver to decelerate in order to attain 
the desired position, altitude and CAS at the metered 
fix. We assume that the target aircraft passes through 
the TOD point at the desired Mach with at least a 3 
nmi equivalent time-based separation from the IM 
aircraft, at which point the IM velocity controller 
then takes over and provides velocity/angle of attack 
input guidance to the IM aircraft to maintain this 
minimum separation up until the deceleration phase 
of the profile (at approximately 12,000 ft MSL). This 
differs from convention, as currently IM software is 
slated to provide speed inputs, and that the aircraft’s 
current FMS system will then establish the pitch. 




Figure 2: Descent Profile of Aircraft for OPD 


Simulation Parameters 

We simulate the 1M operated aircraft with the 
feedback linearized 1M velocity controller for the 
descent scenario described above. We exit the cruise 
phase at approximately FL360 with a speed of 340 
kts at a distance of approximately 115 nmi from the 
airport runway. We wish to arrive at the metered fix. 
approximately 30 nmi from the runway at a speed of 
180 kts at 10000 ft MSL. We wish to terminate the 
unpowered portion of the descent at a distance of 35 
nmi from the runway, at a speed of 240 kts and at 
12,000 ft MSL. We use the following general 
parameters for calculating the relevant altitude 
dependent quantities necessary for our governing 
equations of motion. 


Ideal Gas Constant (J/(mol*K) 

8.31447 

Lapse Rate (K/m) 

0.0065 

Specific Mass of Air (kg/mol) 

0.0289644 


Table 1: Atmospheric Parameters [23-24] 

Furthermore, we use the Naval Atmospheric Tables 
in order to calculate the air temperature, pressure, 


density, dynamic viscosity based on the atmospheric 
altitude, as well as the gravitational constant g [23- 
24], 


Landing Mass of 777 (kg) 

223168 

Wingspan (m) 

60.9 

Chord (m) 

7.02463054 

Aspect Ratio (m) 

7.4 

Wing Area (m A 2) 

427.8 

Max Thrust (kN) 

436 


Table 2: Boeing 77-300 Parameters [25-26] 


We use the performance characteristics of the Boeing 
777-300 for both our IM and target aircraft, as well as 
for the lift coefficient c i, which is a function of a 
[26], 

Simulation Results 

We simulate the 4-D trajectory in the low fidelity 
simulation environment using the feedback linearized 
velocity controller in order to maintain a separation 
of 3 nmi between the IM and target aircraft. We 
assume that the target aircraft is conforming to its 
flight plan, and adjust the flight path angle of the IM 
aircraft to maintain the required true airspeed and 
position in order to maintain the IM tolerance 







between aircraft. This is similar to a concept being 
used by Boeing-Madrid, referred to as ‘speed on 
pitch’. We forward propagate the aircraft equations 
of motion via both the Euler and Runga-Kutta 
integration schemes, under two different timesteps: 1 
second and 60 seconds. The concept of dropped 
messages was simulated by the lack of feedback 
presented through the measurement y. Thus, if a 
message is dropped, the controller propagates the 
control law forward based on its own internal 
dynamics, without the aid of a rectifying 
measurement. The choice of the secondary time step 
of 60 seconds allowed us to simulate a dropped 
message once every 60 seconds, by starting the 
following 60 second time step at an offset set of 
values for the initial integration conditions for the 
controller. The results are summarized below. 


For the described PID velocity controller, we 
attempt to maintain the desired trajectory under 
constant thrust until 12,000 ft MSL. 



Figure 3: Difference between Projected Positions 
(in m) at Waypoints under PID Control during 
IM OPD maneuver, over time (in seconds) 


The difference in projected position is the total 
error (\\q(t wp ) - q wp (t wp )\\ ), between the actual 
position and desired position at the time the aircraft 
was to have achieved the waypoint. Note that the 
final point at 10,000 ft MSL is sufficiently disparate 
(Figure 3) due to the addition of thrust below 12,000 
ft MSL, in order to achieve the required time of 
arrival with a 3 degree descent profile at 10,000 ft 
MSL (the standard descent angle). This can be seen 
at the point at approximately 1000 seconds, which 
possesses no positional error, in Figure 3. This 
addition of thrust is not modeled by our controller, 
which leads to the error seen after approximately 
1000 seconds. If we allow the aircraft to descend 


with flight path angles in excess of 4 degrees at 
10,000 ft MSL, we do not have this problem, as 
thrust need not be applied, and the RTA will be met 
automatically. However, we are aware that this steep 
of a descent profile is not generally practiced, and 
thus we attempted to shallow the profile at the end of 
the flight, and still meet the RTA. 



Figure 4: Difference between Projected Velocity 
(in m/S) at Waypoints under PID Controller 
during IM OPD maneuver over time (in min) 


Prior to the addition of thrust, the target velocity 
of 250 kts at 35 nmi distance from the airport 12,000 
ft MSL for the IM aircraft was achieved with a 5 
second difference between the estimated time of 
arrival and actual time of arrival. That is, the aircraft 
arrived at the desired position with the desired 
velocity (to within a 2.5 kts tolerance, 5 seconds 
late). This is seen in Figure 4, which is a graph of 
the velocity error versus time in flight (given in 
minutes). 

For the case of one-second timesteps, the RK 
and Euler integration schemes provide almost the 
exact same 4-D trajectories, with a negligible 
difference of approximately 10 cm at the metered fix. 
For the 60 second timestep, the difference in the end 
position of the two trajectories differs by 
approximately half a meter (Figure 5). Thus, a 
sufficiently small step size will result in 
approximately equivalent results using the RK and 
Euler methods, even with the non-linear dynamics. 
Hence, the controller is able to achieve a positional 
accuracy to within approximately half a meter, and a 
velocity error of about 2.5 kts, to within 5 seconds of 
the required time of arrival. 

Simulating a dropped message once every 60 seconds 
during the constant thrust portion of the simulation 
(i.e., 7 dropped messages) resulted in a larger 
deviation in position. For this simulation we used the 


numerically stable (reversible) Euler method of 
integration, coupled with the theoretically stable 
feedback linearized controller, and substituted the 
feedback measurement with a vacant sample (the 
estimated position given the controller’s internalized 
dynamics for the aircraft plant). Before the addition 
of thrust, the controller maintains a descent profile 
that achieves the desired RTA to within a velocity 
error of about 2.5 kts at the final fix. The lack of 
significant increase in velocity error is due to the fact 
that it is a second order effect. As no two messages 
are dropped in succession, the inertia inherent in the 
plant dynamics acts to damp the controller response, 
thereby mitigating the error. As the messages are 
resumed, the positional error is driven to the 0.5 m 
system steady state error. The worst case scenario 
for the error, under this fault model, occurs when the 
message is dropped about 4 seconds prior to attaining 
a waypoint. This results in a positional error of 
approximately 600 m at the waypoint (Figure 5). 
This is reflected in the tuning parameters of the 
controller, as this is approximately the oscillatory 
period of the critical gain. Thus, the system 
dynamics do not have sufficient time to damp out any 
overshoot engendered by the vacant sample. Thus, 
for a sufficiently small step size (i.e., one second), the 
PID controller is numerically stable and maintains the 
IM tolerance to within a 600 m range of error in the 
presence of a dropped message. 



Figure 5: Difference between Positions (in m) at 
Waypoints between Controller Performance for 
Nominal (1 second time step) and Dropped 
Messages (60 second time step) (in s) over IM 
OPD maneuver 


Conclusions 

We have designed a reusable model of a theoretically 
and numerically stable velocity controller for a ‘Mid- 
Term’ IM operational concept. The model addresses 
communication faults and failures, as well as 
computational error due to integration schemes and 
non-linearities arising from modeling uncertainties. 
This controller model possesses stability guarantees, 
and can be employed in an assessment of the 
emergent behavior of other current and future ATM 
operational concepts (i.e., RTA, etc.) which adhere to 
the enumerated fault hypotheses and environmental 
assumptions. 

The model is executable as well as analyzable. 
Given the publically accessible parameters outlined 
in the paper, reproducible simulations of aircraft 
trajectories under IM can be generated. Throughout 
the simulation, the controller achieved an upper error 
bound of 600 m and 2.5 kts of a required fixed point 
for a 60 second vacant sample period for the descent 
profile given. The integral component of the 
controller efficiently reduced cumulative error over 
the vacant sample period of 60 second, and was tuned 
to eliminate the steady state error. 

As future work, we wish to incorporate disturbances 
such as variable winds, which can be modeled as 
additive white Gaussian noise, as well as associated 
quadratic cost functions to optimize trajectories. 
Thus, we wish derive a reusable LQG controller 
model to meet the requirements specifications 
outlined for the ‘Maintain’ phase of a ‘Mid-Term’ IM 
Operational Concept, and compare its performance to 
the stable linearized feedback controller. 
Furthermore, we wish to investigate different 
communication paradigms which may be employed 
in future (2045-onwards) ATM Operational 
Concepts, such as Controller Pilot Data Fink 
Communication (CPDFC), as well as fault models, 
and analyze their impact on emergent system 
behavior. We also wish to study if and how we can 
achieve required levels of precision for the minimum 
energy required, as well as stability guarantees, under 
differing communication paradigms. 
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